search

sjkp / letsencrypt-siteextension

Azure Web App Site Extension for easy installation and configuration of Let's Encrypt issued SSL certifcates for custom domain names.
745 stars 76 forks source link

502 - Web server received an invalid response while acting as a gateway or proxy server. #331

Closed modemgeek closed 5 years ago

modemgeek commented 5 years ago

On one particular webapp, we started getting this 502 error when going to the /letsencrypt/ We haven't made any changes to it. I have also tried upgrade to 0.9.6 (from 0.9.5) but same issue happens. Once you are on /letsencrypt and click Next it hangs for a bit and then the 502 error pops up. Any idea of what is causing this behavior or where I can look for errors?

I can also browse to /letsencrypt/Home/Install and select a hostname. When I click the button request and install certificate, I get the same 502 error.

RobDeVoer commented 5 years ago

My sites have been out all day due to somehow the certificates generated through the webjobs not being valid? Looked and tried for a long time to resolve this but unable to. Bought a few certificates to get my clients back online. Hoping for a solution to the 502 error before I have more sites needing a certificate.

@shanselman any feedback from the service team?

DylanTusler commented 5 years ago

This worked for me too. Adding the connection string settings and restarting (actually stopping and starting because there was no Restart button) the web job resulted in the certificate for my site being renewed immediately. (It would've expired in 4 days.) Thank you so much!

While this may work to renew certificates creating new ones still doesn't work.

I'd also like to know (and this should be specified in the documentation) if the ConnectionStrings are set as appsettings or as connectionstrings.

Doesn't matter. I've done it both ways.

DylanTusler commented 5 years ago

Firstly, thanks @sjkp this really is a great extension!

I'm having the same issue as above when creating a new certificate and tried the above, however my web job is stuck in "Pending Restart" with the error below:

Any ideas anyone? Thanks in advance!

The configuration is not properly set for the Microsoft Azure WebJobs Dashboard. A connection string named AzureWebJobsDashboard is not well-formed. In your Microsoft Azure Website configuration you must set a connection string named AzureWebJobsDashboard by using the following format DefaultEndpointsProtocol=https;AccountName=NAME;AccountKey=KEY pointing to the Microsoft Azure Storage account where the Microsoft Azure WebJobs Runtime logs are stored. Please visit the article about configuring connection strings for more information on how you can configure connection strings in your Microsoft Azure Website.

I had that problem too. I found if you copy the connection string from the storage object itself as I detailed above, that resolved this issue.

sjkp commented 5 years ago

Hi friends (as hanselman would have said it) Microsoft have a work around. We need to browse the KUDU/SCM site using basic auth not SSO.

Basic Auth is available using https://<yoursite>.scm.azurewebsites.net/basicauth the username + password you need to use are those from the publishing crendential file userName and userPWD

bcornett commented 5 years ago

Basic auth worked great for me, thanks for the work around!

shanselman commented 5 years ago

Just to make it SUPER clear if someone shows up here, @sjkp, the steps (until this is fixed) to force a refresh are:

bclevering commented 5 years ago

Hi friends (as hanselman would have said it) Microsoft have a work around. We need to browse the KUDU/SCM site using basic auth not SSO.

Basic Auth is available using https://<yoursite>.scm.azurewebsites.net/basicauth the username + password you need to use are those from the publishing crendential file userName and userPWD

-- when i try this i get the following error while requesting the certificate:

image

lhuswe commented 5 years ago

Basic auth worked great!

Luunk commented 5 years ago

Basic auth works for new .NET core sites as well 👍 Just installed a fresh new cert on a site. Thx for all hard work, and a great extension!

Variel commented 5 years ago

Basic auth works very well! thanks 👍

sanderdam commented 5 years ago

Fresh new user of the webjob here. The workaround by using basicauth to login to kudu, scm worked like a charm!

stephanjohnson commented 5 years ago

The workaround of using basicauth worked for me as well.

Thanks for everyone working on this.

@sjkp you're awesome

garethrampton commented 5 years ago

Hi friends (as hanselman would have said it) Microsoft have a work around. We need to browse the KUDU/SCM site using basic auth not SSO. Basic Auth is available using https://<yoursite>.scm.azurewebsites.net/basicauth the username + password you need to use are those from the publishing crendential file userName and userPWD

-- when i try this i get the following error while requesting the certificate:

image

Seeing exactly this issue here too

webmatikbg commented 5 years ago

The workaround of using basicauth worked for me as well.

Thanks

sjkp commented 5 years ago

@garethrampton @bclevering do you have an app setting configured with letsencrypt:AcmeBaseUri that points to one of the old endpoints? Please use https://acme-v02.api.letsencrypt.org/directory or https://acme-staging-v02.api.letsencrypt.org/directory for the new V2 endpoints. I'm not sure my 1.0.1 patch handles if you had these configure before, and just did and upgrade.

garethrampton commented 5 years ago

@sjkp I did have the correct v2 endpoint configure in my app settings, but since removed it - along with the email and hostnames config options too to see if that was impacting things - no change.

Interestingly though - with the same app service plan last night the App Service Acmebot function app was also failing to succeed for the same app, yet this morning it has worked and installed a new certificate.

The app service is in the UK South region, and was newly spun up, so had no pre-existing SSL installed if that makes a difference.

At least now I've got the SSL installed the extension will hopefully now continue to renew with the WebJob.

bclevering commented 5 years ago

@garethrampton @bclevering do you have an app setting configured with letsencrypt:AcmeBaseUri that points to one of the old endpoints? Please use https://acme-v02.api.letsencrypt.org/directory or https://acme-staging-v02.api.letsencrypt.org/directory for the new V2 endpoints. I'm not sure my 1.0.1 patch handles if you had these configure before, and just did and upgrade.

@sjkp I did update the appsettings in Azure and also did a manual reset of the web app. But still the same issue appears. :(

dlucre commented 5 years ago

Using BasicAuth also worked for me. Once again, Scott comes to the rescue. If you keep getting prompted for the user/pass when trying basic auth, it might be because you're providing the username in the DOMAIN\$USERNAME format. If so, use $USERNAME only.

Jjarrard commented 5 years ago

Possibly a stupid question: I'm just using an app service to host a .net core project, and don't have the options to FTP and never set up a username or password. BasicAuth requires a username and password, is it possible to create a user/pass?, or am I not going to be able to use the work around?

osvaldolove commented 5 years ago

@Jjarrard try downloading the Publish Profile from the overview tab. Credentials should be in the file.

Jjarrard commented 5 years ago

@osvaldolove brilliant, thanks!

Work around worked, thanks so much guys!

Marcel0024 commented 5 years ago

Workaround also worked for me!

Jabe commented 5 years ago

To get the credentials, just open the App Service in the Azure Portal, go to Deployment Center ...

You can also use the Resource Explorer to access the API and navigate to config/publishingcredentials.

davidverriere commented 5 years ago

Using basicAuth and login with FTP credential withou domain works for me thanks Scott

unencode commented 5 years ago

Same here, works with Basic. Thanks for the workaround!

jjghali commented 5 years ago

@shanselman you are a lifesaver :dancer:

valentim89 commented 5 years ago

Hi Guys,

I am having the same trouble. When I am attempting the "basicauth" workaround after entering my credentials I get "error 403 - This web app is stopped"

But it is not! Can you guys advise?

Thanks for all the effort

EDIT: It seems I was using the wrong Creds. So bypass this. However:

scm

Any ideas?

NEW EDIT:

I should really learn to read before I post, I needed to update the plugin! I can confirm the basicauth also works for me!

Thanks a lot guys

perrakay commented 5 years ago

I'm the one who posted the question on Serverfault as mentioned by @tdoumas.

Changed to basicauth which got me a little bit further, but now I'm stuck with the exact same problem as @bclevering:

image

Also added the letsencrypt:AcmeBaseUri application setting, but it did not make any difference.

Thankful for help!

seriousfish commented 5 years ago

Basic Auth also worked for me, but the Webjob never gets created? Any instructions to create that manually with the settings I need?

ahmelsayed commented 5 years ago

Quick update from Azure side; a fix started rolling out yesterday, we're tracking updating some US regions today and finishing the upgrade globally by next week.

sjkp commented 5 years ago

Please update to 1.0.4 to get proper error reporting. And then make new issues, unless it is related to this one, if you still have errors.

robertmclaws commented 5 years ago

I'm still getting the same error with 1.0.4, even after totally uninstalling and reinstalling the extension. The only luck I had was with the /basicauth workaround. I have a couple other sites to set up, but I'll hold off for a couple days till the rest of the rollout happens.

m4nthys commented 5 years ago

Please update to 1.0.4 to get proper error reporting. And then make new issues, unless it is related to this one, if you still have errors.

I still have the same error with 1.1.4. =/ domain: icollect.com.br

sjkp commented 5 years ago

1.0.4 doesn't fix the 502 problem that Microsoft introduced, you still have to use basic auth, until their fix is rolled out. I can't fix the app service infrastructure ;)

alfkla commented 5 years ago

Hi, thanks for wonderfull extension, I use it a lot! I have updated it to 1.0.4 on one webapp today and tried to run it, but it still fails. Then I tried the login at https://.scm.azurewebsites.net/basicauth (with credentials from the publish profile) and got into the Kudu environment page. But what's next, if I try to continue using https://.scm.azurewebsites.net/letsencrypt/home/install (writing this url in the address field in my webbrowser) I only end up with this error:

Server Error in '/letsencrypt' Application. 'authority' Uri should have at least one segment in the path (i.e. https:////...) Parameter name: authority Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

smsapi_error

Any ideas of what I am doing wrong?

Kind regards, Alf

shanselman commented 5 years ago

I'm told the fix is being rolled out ASAP.

On Mon, Oct 14, 2019 at 4:20 AM Alf Normann Klausen < notifications@github.com> wrote:

Hi, thanks for wonderfull extension, I use it a lot! I have updated it to 1.0.4 on one webapp today and tried to run it, but it still fails. Then I tried the login at https://.scm.azurewebsites.net/basicauth (with credentials from the publish profile) and got into the Kudu environment page. But what's next, if I try to continue using https://. scm.azurewebsites.net/letsencrypt/home/install (writing this url in the address field in my webbrowser) I only end up with this error:

Server Error in '/letsencrypt' Application. 'authority' Uri should have at least one segment in the path (i.e. https:// //...) Parameter name: authority Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

[image: smsapi_error] https://user-images.githubusercontent.com/17759364/66747642-51167c80-ee85-11e9-8b44-f0f0f74dddbe.png

Any ideas of what I am doing wrong?

Kind regards, Alf

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/sjkp/letsencrypt-siteextension/issues/331?email_source=notifications&email_token=AAAAWTHMXSMZFBQPFO65VXLQORIW5A5CNFSM4I4YPFD2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEBEHQZQ#issuecomment-541620326, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAAAWTBIRQVQ2CK4GSSSGTLQORIW5ANCNFSM4I4YPFDQ .

RobDeVoer commented 5 years ago

Big thanks @sjkp and @shanselman for your efforts to get this resolved. Really appreciated.

sjkp commented 5 years ago

@alfkla please start at https://<your-site>.scm.azurewebsites.net/letsencrypt/ unless you have already configured the site before. And use basicauth as you did, until we have a confirmation that the patch is applied globally.

shanselman commented 5 years ago

This should be patched everywhere now.

kilasuit commented 5 years ago

This should be patched everywhere now.

I can confirm this now looks to be working as expected as I have managed to get a new Certificate where I was unable to previously

alfkla commented 5 years ago

Thanks a lot @sjkp and @shanselman - now it works fine!

Petryxasport commented 5 years ago

@sjkp thanks, now everything works correctly!

asp1egui commented 4 years ago

Great article! Thanks!

I want to do a comment if you allow me.

https://dipoletechi.com/blog-post/502-web-server-received-an-invalid-response-while-acting-as-a-gateway-or-proxy-server-on-azure-web-app/

so the only option is to upgrade the service plan ?